BgInfo[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

BgInfo.exe
Size

2.6MB
MD5

872669f9a36e7dcde58f3fbaf2f853fc
SHA1

510ab6e0db9a0de3d95e5696f4436ac9598870e6
SHA256

d7e0360ba3fa7a59688aa5c922d4b2e21f620915f4a902dfd3f04a7e9259c663
SHA512

b6081cb7bb52d1baf4eb3bf01547d5232c8a5cf871f3494214a9541ef10273043b0d1e66e62ffd04411e4337b98f201b73502aafbd31de3712e902381bb5b4c5
SSDEEP

49152:O2bwsVz6MuVlZnnDAPTGihDLzN+EdyURVltx2lvIulxZdX4aWlLVgl4r5J28u0F:Nztj2BZdElRglAJ28um

Score

1^/10

Malware Config

Signatures

Files

BgInfo.exe
.exe windows x64

874cff38ca5cdc51dc0e61e5c27203dd

Code Sign

33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/05/2022, 20:46

Not After

11/05/2023, 20:46

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:1c:23:33:8a:02:a3:a8:94:fb:0f:3d:a9:aa:ac:a5:21:bd:5d:48:73:f0:c3:cf:6d:ac:d0:d3:11:5d:3f:14
Signer

Actual PE Digest

39:1c:23:33:8a:02:a3:a8:94:fb:0f:3d:a9:aa:ac:a5:21:bd:5d:48:73:f0:c3:cf:6d:ac:d0:d3:11:5d:3f:14

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

snmpapi

SnmpSvcGetUptime
SnmpUtilOidNCmp
SnmpUtilOidCpy

netapi32

NetApiBufferFree
NetServerGetInfo
NetWkstaGetInfo
NetWkstaUserGetInfo

odbc32

ord9
ord31
ord75
ord136
ord141
ord24

kernel32

OutputDebugStringW
RtlPcToFileHeader
GetConsoleCP
VirtualAlloc
HeapQueryInformation
CreateThread
ExitThread
FreeLibraryAndExitThread
GetCommandLineA
SetStdHandle
GetCPInfo
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
IsValidLocale
EnumSystemLocalesW
FlsAlloc
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
WaitForSingleObjectEx
ResetEvent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetUserDefaultLCID
GetTempFileNameW
SearchPathW
GetProfileIntW
GetTickCount64
GetTempPathW
VerifyVersionInfoW
VerSetConditionMask
GetWindowsDirectoryW
GetCurrentDirectoryW
lstrcpyW
VirtualProtect
GetUserDefaultUILanguage
GetLocaleInfoW
GetFileTime
GetFileSizeEx
GetFileAttributesExW
lstrcmpiW
DuplicateHandle
VirtualQuery
UnlockFile
LockFile
FlushFileBuffers
ResumeThread
SetThreadPriority
CreateEventW
WaitForSingleObject
SetEvent
GlobalFlags
GlobalFindAtomW
GlobalAddAtomW
lstrcmpW
GlobalDeleteAtom
GetCurrentThreadId
GlobalGetAtomNameW
lstrcmpA
GetCurrentProcessId
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
GetModuleHandleExW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringA
CompareStringW
CopyFileW
GlobalSize
SystemTimeToTzSpecificLocalTime
FreeLibrary
DeleteCriticalSection
InitializeCriticalSectionEx
RaiseException
GetFileType
GetStdHandle
WideCharToMultiByte
FindResourceExW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
SetFilePointer
SetLastError
GetSystemInfo
LoadLibraryW
LoadLibraryExW
IsWow64Process
GetVersionExW
DecodePointer
EncodePointer
GetFileAttributesW
DeleteFileW
GetEnvironmentStringsW
GetCommandLineW
GetFullPathNameW
GetModuleFileNameW
OpenProcess
GetExitCodeProcess
TerminateProcess
ExitProcess
GetCurrentProcess
WaitForMultipleObjects
MulDiv
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
FindResourceW
SizeofResource
LockResource
LoadResource
GetProcAddress
GetModuleHandleW
Sleep
CreateDirectoryW
MultiByteToWideChar
GetTimeFormatW
GetDateFormatW
SystemTimeToFileTime
FileTimeToSystemTime
GetComputerNameW
GetNativeSystemInfo
GetTickCount
GlobalMemoryStatusEx
QueryPerformanceFrequency
QueryPerformanceCounter
SetErrorMode
ReadFile
GetVolumeInformationW
GetLogicalDriveStringsW
GetFileSize
GetDriveTypeW
GetDiskFreeSpaceExW
FindFirstFileW
FindClose
FileTimeToLocalFileTime
ExpandEnvironmentStringsW
GetEnvironmentVariableW
FormatMessageW
LocalFree
LocalAlloc
GetSystemDirectoryW
GetLocalTime
GetLastError
CloseHandle
WriteFile
SetEndOfFile
CreateFileW
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetTimeZoneInformation
GetConsoleMode
SetConsoleMode
ReadConsoleInputW
ReadConsoleW
GetConsoleOutputCP
SetFilePointerEx
FindFirstFileExW
FindNextFileW
FreeEnvironmentStringsW
SetEnvironmentVariableW
WriteConsoleW
RtlUnwindEx

user32

CallNextHookEx
SetWindowsHookExW
GetWindow
GetTopWindow
GetClassLongPtrW
EqualRect
CopyRect
RemovePropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
ValidateRect
GetForegroundWindow
SetActiveWindow
SetMenu
GetCapture
GetKeyState
GetDlgCtrlID
IsChild
IsMenu
IsWindow
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetMessageTime
GetMessagePos
PeekMessageW
RegisterWindowMessageW
GetLastActivePopup
GetWindowThreadProcessId
IsWindowEnabled
UnhookWindowsHookEx
LoadBitmapW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
GetFocus
RemoveMenu
AppendMenuW
InsertMenuW
GetMenuItemCount
GetMenuItemID
GetMenuState
GetMenuStringW
DialogBoxIndirectParamW
DrawIconEx
LoadImageW
EnableMenuItem
CheckMenuItem
SetCapture
EmptyClipboard
RegisterClipboardFormatW
SetClipboardData
CloseClipboard
OpenClipboard
DrawEdge
MonitorFromWindow
IsDialogMessageW
LoadIconW
LoadCursorW
CheckMenuRadioItem
GetClassNameW
EnumChildWindows
GetParent
SetWindowLongPtrW
GetWindowLongPtrW
SetWindowLongW
GetWindowLongW
PtInRect
UnionRect
IntersectRect
FrameRect
RealChildWindowFromPoint
DestroyIcon
SetScrollInfo
DrawTextExW
MapWindowPoints
ScreenToClient
GetCursorPos
SetCursor
MessageBoxW
GrayStringW
TabbedTextOutW
GetWindowDC
DestroyMenu
CopyImage
AdjustWindowRectEx
GetWindowRect
GetClientRect
GetWindowTextLengthW
GetWindowTextW
GetPropW
SetPropW
InvalidateRect
EndPaint
BeginPaint
SetForegroundWindow
UpdateWindow
SetMenuDefaultItem
SetMenuItemInfoW
GetMenuItemInfoW
TrackPopupMenu
GetSubMenu
GetMenu
LoadMenuW
TranslateAcceleratorW
LoadAcceleratorsW
EnableWindow
KillTimer
SetTimer
GetActiveWindow
SetFocus
DefDlgProcW
IsDlgButtonChecked
CheckRadioButton
CheckDlgButton
GetDlgItemTextW
SetDlgItemTextW
GetDlgItem
EndDialog
DialogBoxParamW
CreateDialogParamW
IsZoomed
IsIconic
IsWindowVisible
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
SetWindowPos
MoveWindow
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassExW
SendDlgItemMessageA
SetRectEmpty
CreateDialogIndirectParamW
GetNextDlgTabItem
GetAsyncKeyState
MapDialogRect
TrackMouseEvent
ShowOwnedPopups
ModifyMenuW
DeleteMenu
GetNextDlgGroupItem
ReleaseCapture
WindowFromPoint
DrawFocusRect
GetScrollInfo
CallWindowProcW
PostQuitMessage
DefWindowProcW
WinHelpW
ClientToScreen
CharUpperW
GetDesktopWindow
IsRectEmpty
GetIconInfo
MessageBeep
EnableScrollBar
HideCaret
InvertRect
NotifyWinEvent
CreatePopupMenu
GetMenuDefaultItem
MapVirtualKeyW
GetSystemMetrics
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
SetSysColors
FillRect
InflateRect
OffsetRect
SystemParametersInfoW
MonitorFromPoint
GetMonitorInfoW
EnumDisplayMonitors
GetProcessWindowStation
GetUserObjectInformationW
PostThreadMessageW
SendMessageW
SetWindowTextW
DrawTextW
LoadStringW
DrawFrameControl
GetMessageW
TranslateMessage
DispatchMessageW
PostMessageW
GetKeyNameTextW
SetLayeredWindowAttributes
DrawStateW
SetClassLongPtrW
SetWindowRgn
SetParent
GetSystemMenu
BringWindowToTop
SetCursorPos
CopyIcon
DrawIcon
UpdateLayeredWindow
InsertMenuItemW
UnpackDDElParam
ReuseDDElParam
GetComboBoxInfo
WaitMessage
GetKeyboardLayout
IsCharLowerW
MapVirtualKeyExW
ToUnicodeEx
GetKeyboardState
CreateAcceleratorTableW
DestroyAcceleratorTable
CopyAcceleratorTableW
SetRect
LockWindowUpdate
GetDoubleClickTime
DestroyCursor
GetWindowRgn
CreateMenu
SubtractRect
TranslateMDISysAccel
DefMDIChildProcW
DefFrameProcW
DrawMenuBar
GetUpdateRect
IsClipboardFormatAvailable
CharUpperBuffW
ChildWindowFromPoint

gdi32

GetWindowExtEx
IntersectClipRect
PtVisible
RectVisible
RestoreDC
SaveDC
ExtSelectClipRgn
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextAlign
TextOutW
ExtTextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
GetTextExtentPoint32W
CombineRgn
CreateRectRgnIndirect
PatBlt
GetViewportExtEx
DPtoLP
GetTextMetricsW
EnumFontFamiliesExW
GetNearestPaletteIndex
GetBkColor
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
CreateEllipticRgn
Ellipse
GetTextColor
CreatePolygonRgn
Polygon
Polyline
CreateRoundRectRgn
LPtoDP
Rectangle
GetRgnBox
OffsetRgn
RoundRect
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
GetTextFaceW
GetStockObject
GetPixel
GetObjectType
GetClipBox
ExcludeClipRect
Escape
CreatePatternBrush
CreateHatchBrush
SetBkColor
CreateBitmap
CreateDCW
CopyMetaFileW
EndPage
StartPage
EndDoc
StartDocW
SetWorldTransform
SetMapMode
SetGraphicsMode
CreateFontW
UpdateColors
SetTextColor
EnumFontsW
CreateFontIndirectW
MoveToEx
SetPixel
LineTo
CreatePen
GdiFlush
UnrealizeObject
SetBrushOrgEx
GetObjectW
SetDIBColorTable
CreateDIBSection
SetStretchBltMode
StretchBlt
SetBkMode
SelectPalette
SelectObject
SelectClipRgn
RealizePalette
GetSystemPaletteEntries
GetPaletteEntries
GetNearestColor
GetDIBits
DeleteObject
DeleteDC
CreateSolidBrush
CreateRectRgn
CreatePalette
CreateCompatibleDC
CreateCompatibleBitmap
SetRectRgn
GetDeviceCaps
BitBlt

msimg32

TransparentBlt
AlphaBlend

comdlg32

CommDlgExtendedError
ChooseColorW
GetSaveFileNameW
GetOpenFileNameW
PrintDlgW

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

RegisterServiceCtrlHandlerW
RegOpenKeyExW
RegQueryValueExW
LsaQueryInformationPolicy
LsaOpenPolicy
LsaClose
LsaFreeMemory
SaferComputeTokenFromLevel
SaferIdentifyLevel
SaferCloseLevel
RegCreateKeyW
RegEnumKeyW
RegGetValueW
RegOpenKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumValueW
RegDeleteKeyW
RegCreateKeyExW
StartServiceW
StartServiceCtrlDispatcherW
SetServiceStatus
RegCloseKey
QueryServiceStatus
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
CloseServiceHandle
RegOpenKeyW
RevertToSelf
ImpersonateLoggedOnUser
GetTokenInformation
FreeSid
EqualSid
AllocateAndInitializeSid
OpenProcessToken
CreateProcessAsUserW
RegSetValueExW
RegDeleteValueW
RegEnumKeyExW
GetUserNameW
ReadEventLogW
OpenEventLogW
CloseEventLog

shell32

SHGetFileInfoW
SHChangeNotify
Shell_NotifyIconW
ShellExecuteW
SHGetPathFromIDListW
DragFinish
SHBrowseForFolderW
SHAppBarMessage
SHGetDesktopFolder
DragQueryFileW
SHGetSpecialFolderLocation

comctl32

CreateToolbarEx
ord17

shlwapi

PathFindExtensionW
PathStripToRootW
PathIsUNCW
PathFindFileNameW
PathRemoveFileSpecW
StrFormatKBSizeW

uxtheme

DrawThemeBackground
GetThemeColor
GetThemePartSize
DrawThemeParentBackground
DrawThemeText
GetThemeSysColor
IsThemeBackgroundPartiallyTransparent
IsAppThemed
GetWindowTheme
OpenThemeData
CloseThemeData
GetCurrentThemeName

ole32

CoInitializeEx
DoDragDrop
OleGetClipboard
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
OleLockRunning
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
CoDisconnectObject
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
CoSetProxyBlanket
CoInitializeSecurity
OleInitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
CreateStreamOnHGlobal
OleRun
CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

VariantTimeToSystemTime
SysAllocStringLen
VarBstrFromDate
VariantClear
VariantInit
LoadTypeLi
VariantChangeType
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayGetUBound
SysStringLen
VariantCopy
OleLoadPicture
SystemTimeToVariantTime
SysAllocStringByteLen
GetErrorInfo
SysStringByteLen
SysFreeString
SysAllocString

ws2_32

WSAStartup

gdiplus

GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown
GdipDrawImageRectI
GdipSetInterpolationMode

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

PlaySoundW

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 588KB - Virtual size: 587KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

874cff38ca5cdc51dc0e61e5c27203dd

Code Sign

33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:ccCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

39:1c:23:33:8a:02:a3:a8:94:fb:0f:3d:a9:aa:ac:a5:21:bd:5d:48:73:f0:c3:cf:6d:ac:d0:d3:11:5d:3f:14Signer

Headers

DLL Characteristics

File Characteristics

Imports

version

snmpapi

netapi32

odbc32

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

ws2_32

gdiplus

oleacc

imm32

winmm

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 588KB - Virtual size: 587KB

.data Size: 30KB - Virtual size: 96KB

.pdata Size: 85KB - Virtual size: 85KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 49KB - Virtual size: 48KB

.reloc Size: 58KB - Virtual size: 57KB

33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

39:1c:23:33:8a:02:a3:a8:94:fb:0f:3d:a9:aa:ac:a5:21:bd:5d:48:73:f0:c3:cf:6d:ac:d0:d3:11:5d:3f:14
Signer

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 588KB - Virtual size: 587KB

.data
Size: 30KB - Virtual size: 96KB

.pdata
Size: 85KB - Virtual size: 85KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 49KB - Virtual size: 48KB

.reloc
Size: 58KB - Virtual size: 57KB